Splunk Search

How to count errors for only a certain application?

lsy9891
Engager

Hi, my query returns exceptions thrown by every application. How do I filter this query to display only certain applications like Application="jobs"?

(index= OR index=_) (host="NETWEBA*" OR host="NETWEBB*" OR host="NETAPPA*" OR host="WEBADMIN*") Exception earliest=-7d@d latest=@d | rex field=WindowsIdentity "\+(?.*?).+monster" | timechart span=1h count by Application

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

You basically need to apply the filter based on Application field. If the field Application is already extracted (coming as part of the base search), you'd apply the filterApplication="YourAppNameHere" in the base search. If The field Application is not already extracted and you're extracting it via that rex command in your search, you'll apply filter after the field is extracted.

Base search filter:

(index=* OR index=_*) (host="NETWEBA*" OR host="NETWEBB*" OR host="NETAPPA*" OR host="WEBADMIN*") Exception Application="YourAppNameHere" earliest=-7d@d latest=@d | rex field=WindowsIdentity "\\\+(?<Somefieldname>.*?)\.+monster" | timechart span=1h count by Application

Filter after subsearch

(index=* OR index=_*) (host="NETWEBA*" OR host="NETWEBB*" OR host="NETAPPA*" OR host="WEBADMIN*") Exception earliest=-7d@d latest=@d | rex field=WindowsIdentity "\\\+(?<Application>.*?)\.+monster" | where Application="YourAppNameHere" | timechart span=1h count by Application

View solution in original post

0 Karma

somesoni2
Revered Legend

You basically need to apply the filter based on Application field. If the field Application is already extracted (coming as part of the base search), you'd apply the filterApplication="YourAppNameHere" in the base search. If The field Application is not already extracted and you're extracting it via that rex command in your search, you'll apply filter after the field is extracted.

Base search filter:

(index=* OR index=_*) (host="NETWEBA*" OR host="NETWEBB*" OR host="NETAPPA*" OR host="WEBADMIN*") Exception Application="YourAppNameHere" earliest=-7d@d latest=@d | rex field=WindowsIdentity "\\\+(?<Somefieldname>.*?)\.+monster" | timechart span=1h count by Application

Filter after subsearch

(index=* OR index=_*) (host="NETWEBA*" OR host="NETWEBB*" OR host="NETAPPA*" OR host="WEBADMIN*") Exception earliest=-7d@d latest=@d | rex field=WindowsIdentity "\\\+(?<Application>.*?)\.+monster" | where Application="YourAppNameHere" | timechart span=1h count by Application

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@lsy9891,

Have you tried adding the condition to the base search ?

ie.

  (index= OR index=_) ......... Application="jobs" earliest=-7d@d latest=@d 

If there are multiple applications , you could try with OR or IN

0 Karma

Sukisen1981
Champion

what all have you tried so far @lsy9891 ?

0 Karma